Java: Model Spring reactive WebClient.uri as a request forgery sink

Author: joshimar

java/ql/lib/change-notes/2026-06-30-spring-webclient-uri-ssrf.md

@@ -0,0 +1,4 @@
+---
+category: minorAnalysis
+---
+* The `uri` method of Spring's reactive `WebClient` is now considered a request forgery sink. Previously only the `create` and `baseUrl` methods were considered. This may lead to more alerts for the query `java/ssrf` (Server-side request forgery).

java/ql/lib/ext/org.springframework.web.reactive.function.client.model.yml

@@ -1,7 +1,9 @@
+# Copyright © 2026 Apple Inc.
 extensions:
   - addsTo:
       pack: codeql/java-all
       extensible: sinkModel
     data:
       - ["org.springframework.web.reactive.function.client", "WebClient", False, "create", "", "", "Argument[0]", "request-forgery", "manual"]
       - ["org.springframework.web.reactive.function.client", "WebClient$Builder", False, "baseUrl", "", "", "Argument[0]", "request-forgery", "manual"]
+      - ["org.springframework.web.reactive.function.client", "WebClient$UriSpec", True, "uri", "", "", "Argument[0]", "request-forgery", "manual"]

java/ql/test/query-tests/security/CWE-918/ReactiveWebClientSSRF.java

@@ -46,4 +46,27 @@ protected void doPost(HttpServletRequest request, HttpServletResponse response)
             // Ignore
         }
     }
+
+    protected void doPut(HttpServletRequest request, HttpServletResponse response)
+            throws ServletException, IOException {
+        try {
+            WebClient webClient = WebClient.create("https://example.com");
+
+            String p = request.getParameter("uri"); // $ Source
+            webClient.get()
+                    .uri(p) // $ Alert
+                    .retrieve()
+                    .bodyToMono(String.class)
+                    .block();
+
+            String p2 = request.getParameter("uri"); // $ Source
+            webClient.get()
+                    .uri(java.net.URI.create("https://example.com" + p2)) // $ Alert
+                    .retrieve()
+                    .bodyToMono(String.class)
+                    .block();
+        } catch (Exception e) {
+            // Ignore
+        }
+    }
 }